The present king of nasties emerged from a domain called Gromozon from which the rootkit received it's name.
Marco Giuliani (EraserHW) describes how the threat works.
Details: Wilders Security Forum topic:
On a related note, Sophos has released a free anti-rootkit tool which joins others already offered by Grisoft (It is a Beta and you will need to register) F-Secure, BitDefender and Sysinternals among others.